diff --git a/http/misconfiguration/https-to-http-redirect.yaml b/http/misconfiguration/https-to-http-redirect.yaml new file mode 100644 index 00000000000..3b6853315b1 --- /dev/null +++ b/http/misconfiguration/https-to-http-redirect.yaml @@ -0,0 +1,25 @@ +id: https-to-http-redirect + +info: + name: HTTPS to HTTP redirect Misconfiguration + author: kazet + severity: info + description: | + Detects whether there is a redirect from https:// to http:// + metadata: + max-request: 1 + verified: true + tags: misconfig,http,https + +http: + - method: GET + path: + - "{{BaseURL}}" + + matchers: + - type: dsl + dsl: + - 'startswith(tolower(location), "http://")' + - 'startswith(tostring(BaseURL), "https://")' + - '(status_code == 301 || status_code == 302 || status_code == 307)' + condition: and